🚀 SecurePush

An AI-powered CLI tool to detect hardcoded secrets in your codebase.

📦 Installation

npm install -g securepush

• Requires Node.js v16+
• Works on Windows, macOS, and Linux
• Free tier available with basic features
• Pro & Business tiers available for advanced features

🎯 Tiers & Pricing

| Tier | Price | Features | |------|-------|----------| | Free | $0 | Basic secret scanning, Git hooks, Pattern matching | | Pro | $20 | AI-powered scanning, Commit messages, Bug fixes, Priority support | | Business | $50 | All Pro features + Team config, Policies, Custom rules, Enterprise support |

Upgrade to Premium

# Check current tier
securepush status

# Upgrade to Pro/Business
securepush upgrade

# Activate license key
securepush activate <license-key>

✨ Features

• 🤖 AI-Powered Detection (Google Gemini integration)
• 🔒 Automatic Git Hooks (pre-commit & pre-push)
• 🚫 Force Push Protection
• 📊 Comprehensive Secret Scanning (API keys, tokens, credentials, etc.)
• ⚡ Fast Regex Scanning (offline mode)
• 🛡️ Minimal False Positives (with AI enabled)
• 🏢 Enterprise-Ready (audit logging, team config, CI/CD support)

⚡ Quick Start

1. Install SecurePush globally:

   npm install -g securepush

2. Initialize in your project:

   securepush init

   • Installs Git hooks automatically
   • Prompts for Gemini AI setup (recommended for production)
   • If you enable AI, you will be prompted to enter your Gemini API key
3. Scan your codebase:

   securepush scan

4. Check status/configuration:

   securepush status

🛠️ Example Commands

# Show help and all commands
securepush --help

# Initialize SecurePush in a repo (installs hooks)
securepush init

# Scan for secrets (AI-powered if enabled)
securepush scan

# Scan with regex-only (offline)
securepush scan --no-ai

# Check SecurePush status
securepush status

# Configure Gemini API key
securepush config --set geminiApiKey=YOUR_KEY

🤖 AI vs. Regex-Only Scanning

| Feature | Gemini AI Enabled | Gemini AI Disabled | |------------------------|----------------------------------|-----------------------------| | Detection | Uses Google Gemini AI to analyze code contextually and catch secrets that may not match regex patterns. | Uses only regex/pattern-based detection for secrets. | | False Positives | Lower (AI understands context, can ignore non-secrets) | Higher (regex may flag non-secrets) | | Detection Rate | Higher (can catch obfuscated or non-standard secrets) | Lower (misses secrets not matching known patterns) | | Performance | Slightly slower (AI API call latency) | Fast (local regex scan only) | | API Key Required | Yes (user must provide Gemini API key) | No | | Privacy | Code snippets sent to Gemini API for analysis | Code never leaves local machine |

• Enable Gemini AI for maximum detection and minimal false positives (recommended for production).
• Disable Gemini AI for fast, offline, pattern-based scanning (good for local/dev, but less secure).

📁 Project Structure

SecurePush/
├── bin/securepush.js          # Global CLI entry point
├── src/
│   ├── cli.js                 # Main CLI logic
│   ├── commands/              # CLI commands (init, scan, config, etc.)
│   ├── scanner.js             # Core scanning engine
│   ├── config.js              # Configuration manager
│   ├── git.js                 # Git operations
│   └── ...
├── .husky/                    # Git hooks
├── package.json
└── README.md

🧩 Prerequisites

• Node.js v16 or higher
• npm (comes with Node.js)
• (Optional) Google Gemini API key for AI-powered scanning

🐞 Troubleshooting

• Node version error? Upgrade Node.js to v16+
• Permission denied on hooks? Run your terminal as administrator or with sudo
• AI not working? Set your Gemini API key: securepush config --set geminiApiKey=YOUR_KEY
• Still stuck? Run with debug: DEBUG=true securepush scan

📄 License

MIT License

🔗 Links

• GitHub
• Documentation
• Support

Stay secure. Ship with confidence. — SecurePush

Centralized Team Configuration (Enterprise/Team Tier)

SecurePush supports a centralized configuration system for enterprise teams. Place a securepush.json file at the root of your repository to enforce security rules and policies for all team members.

Example securepush.json

{
  "admins": ["alice", "bob"],
  "locked": true,
  "policies": {
    "blockSecrets": { "enabled": true },
    "dependencies": { "approved": ["react", "express"] }
  }
}

• admins: List of usernames who can modify the config when locked.
• locked: If true, only admins can change the config.
• policies: Define commit/push rules, dependency allowlists, and more.

License Tiers

• Free: Basic secret scanning, limited rules, community support.
• Pro ($20): All Free features, advanced scanning, AI commit messages, bug fix suggestions, priority support.
• Business/Team ($50): All Pro features, centralized config, enforced policies, admin lock, enterprise support.

CLI Integration

• Team admins can lock/unlock or edit the team config via securepush config (Team tier only).
• All commit/push/audit/scan commands will enforce the centralized config if present and license tier is Team.

See the Pricing page for a full feature breakdown.